Skip to content

Commit da77a6f

Browse files
laanwjlaanwj
committed
Merge pull request #6354
6e849b8 Ideal release process for Windows detached signing (Micha) a3ba9a5 gitian: make the windows signing process match OSX (Cory Fields)
2 parents 0564c5b + 6e849b8 commit da77a6f

File tree

3 files changed

+27
-20
lines changed

3 files changed

+27
-20
lines changed

‎contrib/gitian-descriptors/gitian-win-signer.yml

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,21 +14,26 @@ remotes:
1414
files:
1515
- "osslsigncode-1.7.1.tar.gz"
1616
- "osslsigncode-Backports-to-1.7.1.patch"
17-
- "bitcoin-win32-setup.exe"
18-
- "bitcoin-win64-setup.exe"
17+
- "bitcoin-win-unsigned.tar.gz"
1918
script: |
2019
BUILD_DIR=`pwd`
2120
SIGDIR=${BUILD_DIR}/signature/win
21+
UNSIGNED_DIR=${BUILD_DIR}/unsigned
2222
2323
echo "f9a8cdb38b9c309326764ebc937cba1523a3a751a7ab05df3ecc99d18ae466c9 osslsigncode-1.7.1.tar.gz" | sha256sum -c
2424
echo "a8c4e9cafba922f89de0df1f2152e7be286aba73f78505169bc351a7938dd911 osslsigncode-Backports-to-1.7.1.patch" | sha256sum -c
2525
26+
mkdir -p ${UNSIGNED_DIR}
27+
tar -C ${UNSIGNED_DIR} -xf bitcoin-win-unsigned.tar.gz
28+
2629
tar xf osslsigncode-1.7.1.tar.gz
2730
cd osslsigncode-1.7.1
2831
patch -p1 < ${BUILD_DIR}/osslsigncode-Backports-to-1.7.1.patch
2932
3033
./configure --without-gsf --without-curl --disable-dependency-tracking
3134
make
32-
33-
./osslsigncode attach-signature -in ${BUILD_DIR}/bitcoin-win32-setup.exe -out ${OUTDIR}/bitcoin-win32-setup-signed.exe -sigin ${SIGDIR}/bitcoin-win32-setup.exe.pem
34-
./osslsigncode attach-signature -in ${BUILD_DIR}/bitcoin-win64-setup.exe -out ${OUTDIR}/bitcoin-win64-setup-signed.exe -sigin ${SIGDIR}/bitcoin-win64-setup.exe.pem
35+
find ${UNSIGNED_DIR} -name "*-unsigned.exe" | while read i; do
36+
INFILE="`basename "${i}"`"
37+
OUTFILE="`echo "${INFILE}" | sed s/-unsigned//`"
38+
./osslsigncode attach-signature -in "${i}" -out "${OUTDIR}/${OUTFILE}" -sigin "${SIGDIR}/${INFILE}.pem"
39+
done

‎contrib/gitian-descriptors/gitian-win.yml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,8 @@ script: |
8484
pushd temp
8585
tar xf ../$SOURCEDIST
8686
find bitcoin-* | sort | tar --no-recursion --mode='u+rw,go+r-w,a+X' --owner=0 --group=0 -c -T - | gzip -9n > ../$SOURCEDIST
87+
mkdir -p $OUTDIR/src
88+
cp ../$SOURCEDIST $OUTDIR/src
8789
popd
8890
8991
ORIGPATH="$PATH"
@@ -109,7 +111,8 @@ script: |
109111
find ${DISTNAME} -type f | sort | zip -X@ ${OUTDIR}/${DISTNAME}-${i}.zip
110112
cd ../..
111113
done
112-
mkdir -p $OUTDIR/src
113-
mv $SOURCEDIST $OUTDIR/src
114+
cd $OUTDIR
115+
rename 's/-setup\.exe$/-setup-unsigned.exe/' *-setup.exe
116+
find . -name "*-setup-unsigned.exe" | sort | tar --no-recursion --mode='u+rw,go+r-w,a+X' --owner=0 --group=0 -c -T - | gzip -9n > ${OUTDIR}/${DISTNAME}-win-unsigned.tar.gz
114117
mv ${OUTDIR}/${DISTNAME}-x86_64-*.zip ${OUTDIR}/${DISTNAME}-win64.zip
115118
mv ${OUTDIR}/${DISTNAME}-i686-*.zip ${OUTDIR}/${DISTNAME}-win32.zip

‎doc/release-process.md

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ Release Process
2525

2626
###update gitian
2727

28-
In order to take advantage of the new caching features in gitian, be sure to update to a recent version (e9741525c or higher is recommended)
28+
In order to take advantage of the new caching features in gitian, be sure to update to a recent version (`e9741525c` or later is recommended)
2929

3030
###perform gitian builds
3131

@@ -66,30 +66,29 @@ Release Process
6666
./bin/gsign --signer $SIGNER --release ${VERSION}-linux --destination ../gitian.sigs/ ../bitcoin/contrib/gitian-descriptors/gitian-linux.yml
6767
mv build/out/bitcoin-*.tar.gz build/out/src/bitcoin-*.tar.gz ../
6868
./bin/gbuild --commit bitcoin=v${VERSION} ../bitcoin/contrib/gitian-descriptors/gitian-win.yml
69-
./bin/gsign --signer $SIGNER --release ${VERSION}-win --destination ../gitian.sigs/ ../bitcoin/contrib/gitian-descriptors/gitian-win.yml
70-
mv build/out/bitcoin-*.zip ../
71-
mv build/out/bitcoin-*-win64-setup.exe inputs/bitcoin-win64-setup.exe
72-
mv build/out/bitcoin-*-win32-setup.exe inputs/bitcoin-win32-setup.exe
69+
./bin/gsign --signer $SIGNER --release ${VERSION}-win-unsigned --destination ../gitian.sigs/ ../bitcoin/contrib/gitian-descriptors/gitian-win.yml
70+
mv build/out/bitcoin-*-win-unsigned.tar.gz inputs/bitcoin-win-unsigned.tar.gz
71+
mv build/out/bitcoin-*.zip build/out/bitcoin-*.exe ../
7372
./bin/gbuild --commit bitcoin=v${VERSION} ../bitcoin/contrib/gitian-descriptors/gitian-osx.yml
7473
./bin/gsign --signer $SIGNER --release ${VERSION}-osx-unsigned --destination ../gitian.sigs/ ../bitcoin/contrib/gitian-descriptors/gitian-osx.yml
75-
mv build/out/bitcoin-*-unsigned.tar.gz inputs/bitcoin-osx-unsigned.tar.gz
74+
mv build/out/bitcoin-*-osx-unsigned.tar.gz inputs/bitcoin-osx-unsigned.tar.gz
7675
mv build/out/bitcoin-*.tar.gz build/out/bitcoin-*.dmg ../
7776
popd
7877
Build output expected:
7978

8079
1. source tarball (bitcoin-${VERSION}.tar.gz)
81-
2. linux 32-bit and 64-bit binaries dist tarballs (bitcoin-${VERSION}-linux[32|64].tar.gz)
82-
3. windows 32-bit and 64-bit unsigned installers and dist zips (bitcoin-${VERSION}-win[32|64]-setup.exe, bitcoin-${VERSION}-win[32|64].zip)
83-
4. OSX unsigned installer (bitcoin-${VERSION}-osx-unsigned.dmg)
84-
5. Gitian signatures (in gitian.sigs/${VERSION}-<linux|win|osx-unsigned>/(your gitian key)/
80+
2. linux 32-bit and 64-bit dist tarballs (bitcoin-${VERSION}-linux[32|64].tar.gz)
81+
3. windows 32-bit and 64-bit unsigned installers and dist zips (bitcoin-${VERSION}-win[32|64]-setup-unsigned.exe, bitcoin-${VERSION}-win[32|64].zip)
82+
4. OSX unsigned installer and dist tarball (bitcoin-${VERSION}-osx-unsigned.dmg, bitcoin-${VERSION}-osx64.tar.gz)
83+
5. Gitian signatures (in gitian.sigs/${VERSION}-<linux|{win,osx}-unsigned>/(your gitian key)/
8584

8685
###Next steps:
8786

8887
Commit your signature to gitian.sigs:
8988

9089
pushd gitian.sigs
9190
git add ${VERSION}-linux/${SIGNER}
92-
git add ${VERSION}-win/${SIGNER}
91+
git add ${VERSION}-win-unsigned/${SIGNER}
9392
git add ${VERSION}-osx-unsigned/${SIGNER}
9493
git commit -a
9594
git push # Assuming you can push to the gitian.sigs tree
@@ -112,8 +111,8 @@ Commit your signature to gitian.sigs:
112111
pushd ./gitian-builder
113112
./bin/gbuild -i --commit signature=v${VERSION} ../bitcoin/contrib/gitian-descriptors/gitian-win-signer.yml
114113
./bin/gsign --signer $SIGNER --release ${VERSION}-win-signed --destination ../gitian.sigs/ ../bitcoin/contrib/gitian-descriptors/gitian-win-signer.yml
115-
mv build/out/bitcoin-win64-setup-signed.exe ../bitcoin-${VERSION}-win64-setup.exe
116-
mv build/out/bitcoin-win32-setup-signed.exe ../bitcoin-${VERSION}-win32-setup.exe
114+
mv build/out/bitcoin-*win64-setup.exe ../bitcoin-${VERSION}-win64-setup.exe
115+
mv build/out/bitcoin-*win32-setup.exe ../bitcoin-${VERSION}-win32-setup.exe
117116
popd
118117

119118
Commit your signature for the signed OSX/Windows binaries:

0 commit comments

Comments
 (0)